InfoSecBulletin Cybersecurity for mankind
The Federal Communications Commission voted to start a program for labeling wireless consumer Internet of Things products with strong cybersecurity. This means that products meeting these standards will have a “U.S Cyber Trust Mark” label, helping consumers make better choices and encouraging manufacturers to improve cybersecurity.
The Commission has adopted the rules and framework for the program. The program highlights are:
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
• The U.S. Cyber Trust Mark logo will initially appear on wireless consumer IoT products that meet the program’s cybersecurity standards.
• The logo will be accompanied by a QR code that consumers can scan for easy-tounderstand details about the security of the product, such as the support period for the product and whether software patches and security updates are automatic.
• The voluntary program will rely on public-private collaboration, with the FCC providing oversight and approved third-party label administrators managing activities such as evaluating product applications, authorizing use of the label, and consumer education.
• Compliance testing will be handled by accredited labs.
• Examples of eligible products may include home security cameras, voice-activated
shopping devices, internet-connected appliances, fitness trackers, garage door openers, and baby monitors.
The Commission is asking for public opinions on extra disclosure requirements. This includes whether the software or firmware for a product is made or used by a company in a country that raises national security concerns. It also includes whether customer data collected by the product will be sent to servers in such a country.
There are many IoT products that use wireless networks. They are made up of different devices and technologies, each with its own security challenges. The Commission proposed a cybersecurity labeling program for IoT last August, and the rules adopted today are based on that proposal.
According to one third party estimate, there were more than 1.5 billion attacks against IoT devices in the first six months of 2021 alone. Others estimate that there will be more than 25 billion connected IoT devices in operation by 2030.
The cybersecurity labeling program is based on existing public and private efforts for IoT cybersecurity and labeling. It highlights the need for ongoing collaboration to help consumers use this technology with more confidence. The Commission approved the action on March 14, 2024.
